# Telegram for Android flaw let attackers run code when a victim answered a voice call · pwn.watch

> NebuSec disclosed a flaw in Telegram for Android that let an attacker with an ordinary Telegram account run code on a victim's phone once the victim answered a voice call. The bug was in the code that parses MediaState call messages (mute, camera and video rotation state), which mishandled missing fields and read memory it should not. Versions 8.6.2 through 12.10.3 (March 2022 to September 2026) are affected; Telegram fixed it in 12.10.4, released in late September. NebuSec confirmed it in private calls on ARM64 phones and has no evidence it directly affects the iOS or desktop apps or group calls. There was no CVE identifier as of October 29.

Page: https://pwn.watch/i/telegram-android-voice-call-mediastate-rce-oct-2026 · generated 2026-10-29T12:55:23.617Z

## Status
- Severity: high · status: live · patch: patched
- Product: Telegram for Android
- Started: 2026-10-29
- Affected: Telegram for Android 8.6.2 through 12.10.3
- Fixed in: Telegram for Android 12.10.4+ (version shown at the bottom of Settings)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/telegram-android-voice-call-mediastate-rce-oct-2026/feed.xml
- JSON Feed: https://pwn.watch/i/telegram-android-voice-call-mediastate-rce-oct-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/telegram-android-voice-call-mediastate-rce-oct-2026.json
- This file: https://pwn.watch/i/telegram-android-voice-call-mediastate-rce-oct-2026/llms.txt

## Updates (newest first)
- 2026-10-29: NebuSec discloses the voice-call code execution flaw with a demo video; The Hacker News confirms the matching bug in Telegram's published 12.10.3 source. (https://x.com/nebusecurity/status/2115601122727702634)
- 2026-09: Telegram for Android 12.10.4 ships the fix, reading the rotation value from the right field in MediaState call messages. (https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html)

## Fix brief
# Security brief: Telegram for Android flaw let attackers run code when a victim answered a voice call

Source: https://pwn.watch/i/telegram-android-voice-call-mediastate-rce-oct-2026 · status: live · severity: high · updated Oct 29, 2026, 12:47 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
NebuSec disclosed a flaw in Telegram for Android that let an attacker with an ordinary Telegram account run code on a victim's phone once the victim answered a voice call. The bug was in the code that parses MediaState call messages (mute, camera and video rotation state), which mishandled missing fields and read memory it should not. Versions 8.6.2 through 12.10.3 (March 2022 to September 2026) are affected; Telegram fixed it in 12.10.4, released in late September. NebuSec confirmed it in private calls on ARM64 phones and has no evidence it directly affects the iOS or desktop apps or group calls. There was no CVE identifier as of October 29.

Severity detail: Remote code execution after the victim answers a call from any Telegram account; no CVE or CVSS score yet

- Product: Telegram for Android

## Affected versions
- Telegram for Android 8.6.2 through 12.10.3

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Telegram for Android 12.10.4+ (version shown at the bottom of Settings)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Oct 29, 2026: NebuSec discloses the voice-call code execution flaw with a demo video; The Hacker News confirms the matching bug in Telegram's published 12.10.3 source.
- Sep 2026: Telegram for Android 12.10.4 ships the fix, reading the rotation value from the right field in MediaState call messages.

## Advisories
- [NebuSec disclosure of the Telegram Android call RCE](https://x.com/nebusecurity/status/2115601122727702634) (NebuSec)

## Write-ups & news
- [Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls](https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html)

## Caveats
No technical write-up from NebuSec yet; the step from the memory bug to code execution rests on its video and statements. Exploitation in the wild not reported.

---
Machine-readable: https://pwn.watch/i/telegram-android-voice-call-mediastate-rce-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.